Method for handling case of detecting unauthorized frame transmitted over onboard network

ABSTRACT

An anomaly handling method that suitably handles a case where the possibility of a vehicle being unauthorizedly controlled so as to suppress the effects thereof is provided. In an anomaly handling method used in one or a plurality of electronic control units installed in one vehicle, an inter-vehicle communication message transmitted from a device installed in the other vehicle is received as an anomaly detection notification, the anomaly detection notification being issued when an unauthorized frame is detected on an onboard network installed in another vehicle, and an anomaly handling processing is selected from a plurality of predetermined anomaly handling processing in accordance with the received content to transition to a safe state for example, and the selected anomaly handling processing is executed.

BACKGROUND 1. Technical Field

The present disclosure relates to technology to handle an unauthorizedframe in a case of having detected an unauthorized frame transmitted inan onboard network where an electronic control unit performscommunication.

2. Description of the Related Art

In recent years, a great number of electronic control units (ECU) havebeen placed in systems in automobiles. A network connecting these ECUsis referred to as an onboard network. Many standards exist for onboardnetworks. The most mainstream of these is a standard called CAN(Controller Area Network), that is stipulated in ISO11898-1.

A CAN is configured using two busses, and each ECU connected to thebuses is called a node. Each node connected to a bus transmits/receivesmessages called frames. A transmitting node that transmits a frameapplies voltage to the two busses, and generates potential differencebetween the busses, thereby transmitting a value “1” called recessive,and a value “0” called dominant. In a case where multiple transmittingnodes transmit recessive and dominant at exactly the same timing, thedominant is transmitted with priority. In a case where there is anabnormality in the format a received frame, a receiving node transmits aframe called an error frame. An error frame is a continuous transmissionof six bits, thereby notifying the transmitting node and other receivingnodes that there is a frame abnormality.

No identifiers indicating the transmission destination or transmissionsource exist in CAN, with the transmitting node attaching an ID called amessage ID to each frame and transmitting (i.e., sending out signals tothe bus), and the receiving nodes only receiving frames of apredetermined message ID (i.e., reading signals from the bus). TheCSMA/CA (Carrier Sense Multiple Access/Collision Avoidance) format isemployed, so when multiple nodes transmit at the same time, arbitrationby message ID is performed, with frames having a smaller message IDvalue being transmitted with higher priority.

Now, there is a risk of an unauthorized ECU transmitting an unauthorizedmessage on the bus, and unauthorizedly controlling the vehicle in whichthe onboard network is installed. In a case where one vehicle isunauthorizedly controlled, an accident may occur such as a collisioninvolving other vehicles nearby.

Also, in recent years, automobiles have come to exchange informationwith various devices and the like over networks, in what is calledconnected cars. For example, using inter-vehicle communication whereinformation is exchanged among vehicles proactively prevents accidents,and enables realization of a safer traffic system. A system thatdistinguishes whether or not a moving object situated near its thevehicle in which it is installed is a danger factor, and notifies othervehicles, is known as a technology using an inter-vehicle communicationsystem (see Japanese Unexamined Patent Application Publication No.2007-310457). While this technology distinguishes whether or not amoving object situated near a vehicle is a danger factor, it does notnotify vehicles following behind of abnormalities within the vehicle.However, in a case where the vehicle is unauthorizedly controlled withinthe vehicle, an accident such as a collision or the like may occur.

SUMMARY

One non-limiting and exemplary embodiment provides an anomaly handlingmethod where, in a case where the possibility that a vehicle is going tobe unauthorizedly controlled is high, this is suitably handled tosuppress the effects thereof. The present disclosure also provides anelectronic control unit (ECU) that, in a case where the possibility ishigh that a vehicle is going to be unauthorizedly controlled, suitablyhandles this.

In one general aspect, the techniques disclosed here feature an anomalyhandling method used in one or a plurality of electronic control unitsinstalled in one vehicle,

wherein, when an unauthorized frame is detected by an onboard networkinstalled in another vehicle, an anomaly detection notificationtransmitted from a device installed in the other vehicle is received,

and wherein an anomaly handling processing is selected from a pluralityof predetermined anomaly handling processing in accordance with acontent of the anomaly detection notification that has been received,and the selected anomaly handling processing is executed.

According to the present disclosure, in a case where an unauthorizedframe is detected in an onboard network of one vehicle, other vehiclesare notified to that effect, so even in a case where one vehicle isunauthorizedly controlled, effects on other vehicles nearby the onevehicle can be suppressed.

It should be noted that general or specific embodiments may beimplemented as a system, a method, an integrated circuit, a computerprogram, a storage medium, or any selective combination thereof.

Additional benefits and advantages of the disclosed embodiments willbecome apparent from the specification and drawings. The benefits and/oradvantages may be individually obtained by the various embodiments andfeatures of the specification and drawings, which need not all beprovided in order to obtain one or more of such benefits and/oradvantages.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram illustrating the overall configuration of aninter-vehicle communication system according to a first embodiment;

FIG. 2 is a diagram illustrating the configuration of a vehicleaccording to the first embodiment;

FIG. 3 is a diagram illustrating a format of a data frame stipulated bythe CAN protocol;

FIG. 4 is a configuration diagram of an anomaly detection ECU accordingto the first embodiment;

FIG. 5 is a diagram illustrating an example of a whitelist stored by theanomaly detection ECU according to the first embodiment;

FIG. 6 is a sequence diagram illustrating an operation example relatingto detection of an unauthorized frame, according to the firstembodiment;

FIG. 7 is a diagram illustrating level information, according to thefirst embodiment;

FIG. 8 is a diagram illustrating an example of the configuration of aninter-vehicle communication message according to the first embodiment;

FIG. 9 is a sequence diagram illustrating operations of each part of avehicle at the time of anomaly detection, according to the firstembodiment;

FIG. 10 is a diagram illustrating an example of handling informationaccording to the first embodiment;

FIG. 11 is a sequence diagram illustrating operations of each part ofthe vehicle at the time of receiving an inter-vehicle communicationmessage according to the first embodiment;

FIG. 12 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages to vehiclesfollowing behind, according to a second embodiment;

FIG. 13 is a diagram illustrating an example of the configuration of aninter-vehicle communication message according to the second embodiment;

FIG. 14 is a sequence diagram illustrating operations of each part atthe time of the vehicle receiving and transferring an inter-vehiclecommunication message, according to the second embodiment (continued inFIG. 15);

FIG. 15 is a sequence diagram illustrating operations of each part atthe time of the vehicle receiving and transferring an inter-vehiclecommunication message, according to the second embodiment (continuedfrom FIG. 14);

FIG. 16 is a diagram illustrating an example of the configuration of aninter-vehicle communication message according to a third embodiment;

FIG. 17 is a diagram illustrating level changing conditions according tothe third embodiment;

FIG. 18 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages to vehiclesfollowing behind, according to the third embodiment;

FIG. 19 is a sequence diagram illustrating operations of each part atthe time of the vehicle receiving and transferring an inter-vehiclecommunication message, according to the third embodiment (continued inFIG. 20);

FIG. 20 is a sequence diagram illustrating operations of each part atthe time of the vehicle receiving and transferring an inter-vehiclecommunication message, according to the third embodiment (continued fromFIG. 19);

FIG. 21 is a diagram illustrating the overall configuration of aroad-vehicle communication system according to a fourth embodiment;

FIG. 22 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages to vehiclesfollowing behind, according to a fifth embodiment; and

FIG. 23 is a diagram illustrating an example of the configuration of aninter-vehicle communication message according to a fifth embodiment.

DETAILED DESCRIPTION

An anomaly handling method according to an aspect of the presentdisclosure is an anomaly handling method used in one or a plurality ofelectronic control units installed in one vehicle. When an unauthorizedframe is detected by an onboard network installed in another vehicle, ananomaly detection notification transmitted from a device installed inthe other vehicle is received. An anomaly handling processing isselected from a plurality of predetermined anomaly handling processingin accordance with a content of the anomaly detection notification thathas been received, and the selected anomaly handling processing isexecuted. Accordingly, at the one vehicle, in a case where anunauthorized frame is detected in an onboard network of another vehicle,notification to that effect can be received, and the effects of anothervehicle being unauthorizedly controlled, for example, can be reduced byanomaly handling processing.

The anomaly detection notification may include level informationindicating one of a plurality of levels, and the selection of anomalyhandling processing may be performed in accordance with the level thatthe level information included in the received anomaly detectionnotification indicates. Accordingly, level information can be set atanother vehicle in accordance with anomaly handling processing soappropriate handling can be performed at the one vehicle in a case wherethere is a possibility that another vehicle will be unauthorizedlycontrolled.

The selection of anomaly handling processing may be performed byreferencing handling information where anomaly handling processing hasbeen correlated with each of the plurality of levels, and may beselection of anomaly handling processing corresponding to the handlinginformation by the level indicated by the level information included inthe anomaly detection notification that has been received. Accordingly,by appropriately setting the level and the content of the anomalyhandling processing as handling information, appropriate handling can beperformed at the one vehicle in a case where there is a possibility thatanother vehicle will be unauthorizedly controlled.

Each anomaly handling processing where the handling information iscorrelated with one or more of the plurality of levels may include atleast one of control to stop traveling of the one vehicle, control tocause the vehicle to proceed slowly, control for the vehicle to maintaininter-vehicle distance as to a vehicle ahead within a certain range, andcontrol to notify the driver of the vehicle. Accordingly, the onevehicle can be transitioned to a safe state in a case where there is apossibility that another vehicle will be unauthorizedly controlled,which can suppress occurrence of accidents including multiple vehicles,for example.

Determination may further be made regarding whether or not apredetermined condition has been satisfied based on contents of thereceived anomaly detection notification. In a case where thepredetermined condition has been satisfied, the anomaly detectionnotification may be transmitted externally from the one vehicle, and ina case where the predetermined condition has not been satisfied, theanomaly detection notification may not be transmitted. Accordingly, ananomaly detection notification may be transferred under certainconditions, so the anomaly detection notification can be transmittedover a rather broad range (vehicles traveling through that range) eventhrough the transmission output used is relatively small in theinter-vehicle communication among individual vehicles, for example.Vehicles to which the anomaly detection notification has beentransmitted can perform handling such as transitioning to a safe state,for example. The transfer is performed conditionally, so usage can berealized where conditions are set such that the transfer is notperformed over an unnecessarily broad range.

The anomaly detection notification may include condition informationindicating a condition for transfer. In a case where the condition fortransfer that the condition information included in the received anomalydetection notification indicates has been satisfied, the determinationmay performed with the predetermined condition having been satisfied,and in a case where the condition for transfer that the conditioninformation indicates has not been satisfied, the determination may beperformed with the predetermined condition not having been satisfied.Accordingly, a vehicle that transmits an anomaly detection notification,for example, can set the transfer conditions for the anomaly detectionnotification.

The anomaly detection notification may include position informationindicating a position measured regarding the other vehicle in which isinstalled the device that has detected the unauthorized frame andtransmitted the anomaly detection notification, the predeterminedcondition being a condition that the position measured regarding the onevehicle and the position indicated by the position information includedin the anomaly detection notification that has been received are withina predetermined range. Also, the anomaly detection notification mayinclude count information indicating a count, the predeterminedcondition being a condition that a count of transfer performed from thedevice that has detected the unauthorized frame and transmitted theanomaly detection notification until receiving the anomaly detectionnotification therefrom is smaller than a predetermined count, whereinthe determination is made regarding whether or not the predeterminedcondition has been satisfied, based on the count information included inthe received anomaly detection notification, and wherein thetransmission is performed upon having updated the count informationincluded in the anomaly detection notification at the time oftransmitting the received anomaly detection notification. Also, theanomaly detection notification may include clock time informationindicating clock time, the predetermined condition being a conditionthat the elapsed time from a clock time indicated by the clock timeinformation included in the received anomaly detection notification isshorter than a predetermined time. According to these, the anomalydetection notification can be transmitted from the vehicle where theanomaly has been detected to a range restricted to a certain level,thereby preventing trouble due to vehicles that are sufficientlydistanced from performing anomaly handling processing (trafficcongestion occurring due to stopping or proceeding slowly as anomalyhandling processing, for example). That is to say, only vehicles withina certain range from the vehicle regarding which the anomaly has beendetected can be transitioned to a safe state for example, rather thanperforming anomaly handling processing to bring all vehicles to a safestate, and effects on the traffic system (occurrence of trafficcongestion, etc.) can be suppressed.

At the time of the transmission of the received anomaly detectionnotification, the transmission may performed upon having updated thelevel information included in the anomaly detection notification basedon a predetermined level changing rule. Accordingly, the anomalyhandling processing is made to differ among the multiple vehicles in theperimeter of the vehicle regarding which the anomaly has been detected.Thus, the level may be set lower the farther away from the vehicleregarding which the anomaly has been detected, etc., for example, andthe lower the level is accordingly, the degree of the anomaly handlingprocessing may be changed from stooping to proceeding slowly, fromproceeding slowly to driving while maintaining a certain inter-vehicledistance, and so forth, for example, so that adverse effects on thetraffic system are smaller.

An anomaly handling method according to an aspect of the presentdisclosure is an anomaly handling method that handles unauthorizedsituations by performing communication among first and second vehicles.A device installed in the first vehicle transmits an anomaly detectionnotification at the time of an onboard network installed in the firstvehicle detecting an unauthorized frame. One or a plurality ofelectronic control units installed in the second vehicle receive theanomaly detection notification, select anomaly handling processing froma plurality of predetermined anomaly handling processing determinedbeforehand in accordance with a content of the anomaly detectionnotification that has been received, and execute the selected anomalyhandling processing. Accordingly, in a case where an unauthorized frameis detected in the onboard network of the first vehicle, handling can beperformed by appropriate anomaly handling processing at the secondvehicle.

When the unauthorized frame is detected, the device installed in thefirst vehicle may perform the transmission including in the anomalydetection notification level information indicating one level selectedbase on, of the plurality of levels predetermined by dividing frame IDs,the frame ID of the unauthorized frame. The one or plurality ofelectronic control units installed in the second vehicle may perform theselection of anomaly handling processing in accordance with the levelindicated by the level information included in the anomaly detectionnotification that has been received. Accordingly, the level informationcan be set for each function type where functions have been classified.Accordingly, the frame IDs can be divided into function types in theonboard network, and anomaly handling processing can be executed inaccordance with the degree of effect occurring from the unauthorizedframe (different effects for each division). Examples of function typesinclude drive-related functions, chassis-related functions, body-relatedfunctions, safety/comfort functions, ITS (Intelligent TransportSystems)-related functions, telematics-related functions,infotainment-related functions, and so forth.

An anomaly handling method according to an aspect of the presentdisclosure is an anomaly handling method used by an electronic controlunit connected to an onboard network installed in one vehicle, whereinan anomaly detection notification is transmitted to another vehicle in acase of having detected an unauthorized frame by the vehicle networkinstalled in the one vehicle. Accordingly, other vehicles can know thatthe possibility that the one vehicle will be unauthorizedly controlledhas risen a certain degree (i.e., that an unauthorized frame has beendetected).

An electronic control unit (ECU) according to an aspect of the presentdisclosure is an electronic control unit including: a processor; andmemory having a program stored therein, the program causing theprocessor to execute operations including receiving an anomaly detectionnotification transmitted from a device installed in an onboard networkinstalled in a vehicle different from a vehicle in which the own unit isinstalled, when the onboard network detects an unauthorized frame, andselecting anomaly handling processing to execute from a predeterminedplurality of anomaly handling processing in accordance with a content ofthe received anomaly detection notification, and executing the selectedanomaly handling processing. A vehicle in which this ECU is installedcan handle an unauthorized frame having been detected at anothervehicle.

An electronic control unit (ECU) according to an aspect of the presentdisclosure is an electronic control unit connected to an onboardnetwork, the electronic control unit including: a processor; and memoryhaving a program stored therein, the program causing the processor toexecute operations including detecting unauthorized frames transmittedin the onboard network, and transmitting an anomaly detectionnotification to a different vehicle from the vehicle in which isinstalled the own unit, in a case where an unauthorized frame isdetected. Accordingly, in a case of having detected an unauthorizedframe, this can be conveyed to other vehicles, and accordingly handlingcan be performed at other vehicles.

These general or specific aspects may be realized by a system, method,integrated circuit, computer program, or computer-readable recordingmedium such as a CD-ROM or the like, and may be realized by anycombination of a system, method, integrated circuit, computer program,and recording medium.

The following is a detailed description of an inter-vehiclecommunication system used in an anomaly handling method according toembodiments. Note that the embodiments described below are all specificexamples of the present disclosure. Accordingly, values, components,placements and connected states of components, steps (processes) and theorder of steps, and so forth illustrated in the following embodiments,are only exemplary, and do not restrict the present disclosure.Components in the following embodiments which are not included in anindependent Claim are optional components. The drawings are allschematic diagrams and are not necessarily created in an exact manner.

First Embodiment

As an embodiment of the present disclosure, description will be madebelow with reference to the drawings regarding an inter-vehiclecommunication system where, in a case of detecting an unauthorized frame(unauthorized CAN message) sent out onto a bus in an onboard networksystem in which multiple onboard ECUs communicate over the bus,notification is made from that vehicle by inter-vehicle communication tovehicles following behind. The vehicles following behind execute anomalyhandling processing so that the vehicle is in a safe state, inaccordance with the contents received by the inter-vehiclecommunication.

1.1 Overall Configuration of Inter-Vehicle Communication System

FIG. 1 is a diagram illustrating the overall configuration of theinter-vehicle communication system. The inter-vehicle communicationsystem is configured including a vehicle 10 (vehicle A), a vehicle 20(vehicle B), and a certification authority 50.

The inter-vehicle communication system here uses a Public KeyInfrastructure (PKI). Each vehicle stores a secret key and a public keycertificate for use in inter-vehicle communication. The public keycertificate includes an electronic signature given by the certificationauthority 50 (CA) that is a trusted third party entity, as acertification of the owner of the public key that makes up a pair withthe secret key. Although one certification authority 50 is illustratedin FIG. 1, there may be multiple certification authorities having ahierarchical relationship. A CA certificate 1300 includes the public keyof the certification authority 50.

The vehicle 10 (vehicle A) stores a vehicle A secret key 1301, a vehicleA public key certificate 1302, the CA certificate 1300, and aCertificate Revocation List (CRL) 1303.

The vehicle 20 (vehicle B) stores a vehicle B secret key 2301, a vehicleB public key certificate 2302, the CA certificate 1300, and a CRL 1303.The vehicle A public key certificate 1302 and vehicle B public keycertificate 2302 are both given an electronic signature using a secretkey (omitted from illustration) of the certification authority 50, anddistributed from the certification authority 50. Recording of the publickey certificate, secret key, etc., to the vehicles (e.g., writing to anECU installed in the vehicle) may be performed at any of themanufacturing stage of the vehicle, the shipping stage thereof, themanufacturing stage of the ECU to be installed in the vehicle, or thelike. The CRL 1303 is issued from the certification authority 50, and isa list of identification information of public key certificates thatshould be revoked.

An inter-vehicle communication message 300 transmitted from vehicle A tovehicle B by inter-vehicle communication is signed using the vehicle Asecret key 1301. For example, the vehicle 10 (vehicle A) is traveling,and the vehicle 20 (vehicle B) is traveling following behind. Althoughdescription will be made assuming that the vehicle 10 is performingwireless communication using a transmission antenna (omitted fromillustration) having backwards-facing directivity, inter-vehiclecommunication may be performed using other communication methods, aslong as a vehicle behind the vehicle 10 by at least a normalinter-vehicle distance can receive. Note that the frequency band usedfor inter-vehicle communication differs depending on the country. As oneexample, 700 MHz is used in japan, and a 5.9 GHz band is used in the USAand Europe. However, the inter-vehicle communication according to thepresent embodiment can be realized technologically without beingrestricted to wireless communication using these frequency bands.

In a case where the vehicle 10 (vehicle A) transmits an inter-vehiclemessage to the vehicle 20 (vehicle B), the inter-vehicle communicationmessage 300 and vehicle A public key certificate 1302 are transmitted.The vehicle 20 uses the public key of the CA certificate 1300 to verifythe signature of the vehicle A public key certificate 1302 that has beenreceived, and then uses the public key of the vehicle A included in thevehicle A public key certificate to verify the signature of theinter-vehicle communication message 300. In a case of having detected anunauthorized CAN message, the vehicle 10 (vehicle A) transmits aninter-vehicle communication message 300 as an anomaly detectionnotification. An anomaly detection notification is a notification forperforming inter-vehicle transmission to the effect that an anomaly hasbeen detected, and the inter-vehicle communication message 300 servingas the anomaly detection notification is an inter-vehicle communicationmessage including information relating to anomaly detection.

1.2 Configuration of Vehicle

FIG. 2 is a diagram illustrating the configuration of the vehicle 10(vehicle A) and the vehicle 20 (vehicle B). The vehicle 10 includes aCAN bus 100, ECUs 101, 102, and 103, an anomaly detection ECU 110, alevel interpreting unit 120, an inter-vehicle communication messageauthentication unit 130, an inter-vehicle communication messagetransmission/reception unit 140, a vehicular safety state instructionunit 150, an external state determining unit 160, an onboard camera 170,a laser radar 180, and a position information acquisition unit 190.

The CAN bus 100 is a communication path in the onboard network, and is abus (signal line) used to exchange frames (CAN messages) among multipleECUs following the CAN protocol. Although FIG. 2 illustrates one bus forsake of convenience, multiple busses may be included, and an ECU havinggateway functions, for example, may transfer CAN message among multiplebusses.

The ECUs 101 through 103 are connected to the CAN bus 100. The ECUs 101through 103 may also be connected to various types of devices such assensors, actuators, or the like (omitted from illustration), and may,for example, acquire the state of devices connected thereto and transmitdata frames representing the state over the CAN bus 100, or receive dataframes to which certain CAN message IDs have been attached in accordancewith an individually-stored reception ID list (a list listing CANmessage IDs to be received), and control the devices connected theretofollowing the content thereof. An ECU is a device that includes, forexample, digital circuits such as a processor (microprocessor), memory,and so forth, analog circuits, communication circuits, and so forth. Thememory is ROM, RAM, and so forth, capable of storing a control program(computer program) to be executed by the processor. The functions of theECU are realized by the processor operating following the controlprogram (computer program), for example. A computer program isconfigured as a combination of multiple command codes representinginstructions to the processor, to achieve predetermined functions.Although only the three ECUs 101, 102, and 103 are illustrated in FIG. 2for sake of convenience, many ECUs are included in the vehicle 10, andcommunicate with each other over the CAN bus 100. These ECUs are eachclassified into one of multiple function types (described later).

The anomaly detection ECU 110 is a type of ECU, that monitors frames(CAN message) flowing over the CAN bus 100 for anomalies, and in a caseof having detected an anomaly, notifies the level interpreting unit 120of anomaly information indicating the content of the anomaly detection.There is a possibility that an unauthorized ECU, for example, may beconnected to the CAN bus 100 and transmit unauthorized CAN messages. Theanomaly detection ECU 110 performs inspection following rules indicatedby a predetermined whitelist (described later), where CAN messageappearing on the bus are determined regarding whether or not anunauthorized can message not conforming to the rules.

The level interpreting unit 120 references the anomaly informationindicating the content of the anomaly detection, determines levelinformation indicating a security level to be included in aninter-vehicle communication message in a case of transmitting aninter-vehicle communication message for anomaly detection notification,and notifies the inter-vehicle communication message authentication unit130 thereof. The security level is determined by differentiationaccording to each function type of CAN message detected as an anomaly(described in detail later with reference to FIG. 7). The levelinterpreting unit 120 also notifies the vehicular safety stateinstruction unit 150 of instructions (execution instructions for anomalyhandling processing) to transition to a safe state in accordance withthe security level indicated by level information included in aninter-vehicle communication message received from another car (anothervehicle), based on predetermined handling information (safety statelist). The anomaly handling processing is control that the vehicularsafety state instruction unit 150 performs, to transition to a satestate. The anomaly handling processing includes anomaly handlingprocessing for control to stop the vehicle from running, anomalyhandling processing for control to cause the vehicle to proceed slowly,anomaly handling processing for control to cause the vehicle to travelwith a predetermined distance between itself and a vehicle ahead,anomaly handling processing for control to notify the driver of thevehicle, and so forth.

When transmitting an inter-vehicle communication message 300, theinter-vehicle communication message authentication unit 130 forms theinter-vehicle communication message 300 including level informationacquired from the level interpreting unit 120 and position informationof the vehicle acquired from the position information acquisition unit190 and so forth, and generates a signature using the secret key of thevehicle and includes this in the inter-vehicle communication message300. The inter-vehicle communication message authentication unit 130also performs signature verification regarding inter-vehiclecommunication messages received from other vehicles, and notifies thelevel interpreting unit 120 of level information included in theinter-vehicle communication messages.

The inter-vehicle communication message transmission/reception unit 140transmits inter-vehicle communication messages to other vehicles, andreceives inter-vehicle communication messages from other vehicles.

The vehicular safety state instruction unit 150 executes anomalyhandling processing upon having received an instruction from the levelinterpreting unit 120 (execution instruction for anomaly handlingprocessing) in accordance with the security level indicated by the levelinformation in an inter-vehicle communication message received fromanother vehicle, thereby giving the parts (the ECUs and so forth) withinthe vehicle instructions to stop the vehicle from running, instructionsto proceed slowly, instructions to travel with a predetermined distancebetween this vehicle and a vehicle ahead, and instructions to notify thedriver of the vehicle. These instructions are given using informationnotified from the external state determining unit 160, and for exampleare given by transmitting CAN messages stipulated beforehand for controlover the CAN bus 100.

The external state determining unit 160 analyzes information acquiredfrom various types of sensors installed in the vehicle, such as theonboard camera 170, laser radar 180, and so forth, and notifies thevehicular safety state instruction unit 150 of information whereby thevehicle can be appropriately transitioned to a safe state, while judgingthe situation nearby its own vehicle. For example, lane markings may bedetected by the onboard camera and surrounding objects detected by thelaser radar, thereby notifying information to appropriately realizepulling the vehicle over to the shoulder and stopping, proceedingslowly, traveling with a predetermined distance as to a vehicle ahead,and so forth.

The position information acquisition unit 190 is realized by a GlobalPositioning System (GPS) receiver for example, acquires positioninformation of the vehicle such as latitude, longitude, altitude, and soforth, and notifies the inter-vehicle communication messageauthentication unit 130.

Note that the level interpreting unit 120, inter-vehicle communicationmessage authentication unit 130, inter-vehicle communication messagetransmission/reception unit 140, vehicular safety state instruction unit150, and external state determining unit 160 are realized by one ormultiple devices (ECUs) configured of electronic circuitry. AlthoughFIG. 2 illustrates the vehicular safety state instruction unit 150 andexternal state determining unit 160 being connected to the CAN bus 100,an arrangement may be made where one or multiple devices realizing thevehicular safety state instruction unit 150 and external statedetermining unit 160 are not directly connected to the CAN bus 100 butrather give the CAN bus 100 instructions via an ECU connected to the CANbus 100, and receive information from the CAN bus 100 thereby.

The vehicle 20 also has the same configuration as the vehicle 10, beingconfigured including a CAN bus 200, ECUs 201, 202, and 203, an anomalydetection ECU 210, a level interpreting unit 220, an inter-vehiclecommunication message authentication unit 230, an inter-vehiclecommunication message transmission/reception unit 240, a vehicularsafety state instruction unit 250, a external state determining unit260, an onboard camera 270, a laser radar 280, and a positioninformation acquisition unit 290. Components which are the same in FIG.2 have different reference numerals but are assigned the same names.

1.3 Data Frame Format

The following is a description of a data frame which is a type of frame(CAN message) used on a network according to the CAN protocol. FIG. 3 isa diagram illustrating a format of a data frame stipulated by the CANprotocol. FIG. 3 illustrates a data frame according to a standard IDformat stipulated in the CAN protocol. A data frame is configuredincluding the fields of a Start Of Frame (SOF), ID field, RemoteTransmission Request (RTR), Identifier Extension (IDE), reserved bit“r”, Data Length Code (DLC), data field, Cyclic Redundancy Check (CRC)sequence, CRC delimiter “DEL”, ACK (Acknowledgement) slot, ACK delimiter“DEL”, and End Of Frame (EOF).

The SOF is made up of 1-bit dominant. The state of the bus is recessivewhen idle, and start of transmission of a frame is notified by beingchanged to dominant by the SOF.

The ID field is made up of 11 bits, and is a field storing an ID (CANmessage ID) that is a value indicating the type of data. Design has beenimplemented so that in a case where multiple nodes start transmission atthe same time, frames with smaller ID values are given higher priority,in order to perform communication arbitration using this ID field.

The RTR is a value identifying a data frame and remote frame, and ismade up of 1-bit dominant in a data frame.

The IDE and “r” are each made up of 1-bit dominant.

The DLC is made up of four bits, and is a value indicating the length ofthe data field. Note that the IDE, r, and DLC are collectively referredto as a control field.

The data field is a maximum of 64 bits, and is a value indicating thecontent of the data being transmitted. The length can be adjusted in8-bit increments. The CAN protocol does not stipulate the specificationof data being transmitted; that is set at the onboard network system 10.Accordingly, the specification is dependent on the model, manufacturer(manufacturing maker), or the like.

The CRC sequence is made up of 15 bits. This is calculated from thetransmitted values of the SOF, ID field, control field, and data field.

The CRC delimiter is made up of 1-bit recessive, and is a sectioningsymbol representing the end of the CRC sequence. The CRC sequence andCRC delimiter are collectively referred to as the CRC field.

The ACK slot is made up of one bit. The transmitting node performstransmission with the ACK slot set to recessive. The receiving nodetransmits the ACK slot as dominant if up to the CRC sequence has beenreceived normally. Dominant has higher priority than recessive, so ifthe ACK slot is dominance after transmission, so the transmitting nodewill be able to confirm that one of the receiving nodes has succeeded inreception of the ACK slot is dominant after transmission.

The ACK delimiter is made up of 1-bit recessive, and is a sectioningsymbol representing the end of the ACK.

The EOF is made up of 7-bit recessive, and represents the end of thedata frame.

1.4 Configuration of Anomaly Detection ECU 110

FIG. 4 is a configuration diagram of the anomaly detection ECU 110. Theanomaly detection ECU 110 is configured including a frametransmission/reception unit 116, a frame interpreting unit 115, ananomaly frame detecting unit 113, a whitelist storing unit 112, a framegenerating unit 114, and an anomaly information notifying unit 111.These components are functional components, and the functions thereofare realized by a communication circuit in the anomaly detection ECU110, a processor or digital circuit or the like that executes a controlprogram stored in memory, and so forth.

The frame transmission/reception unit 116 transmits and receives frames(CAN messages) following the CAN protocol to and from the CAN bus 100.That is to say, the frame transmission/reception unit 116 receivesframes from the CAN bus 100 one bit at a time, and transfers to theframe interpreting unit 115. The contents of frames that have beennotified by the frame generating unit 114 are also transmitted to theCAN bus 100.

The frame interpreting unit 115 receives values of frames from the frametransmission/reception unit 116, and performs interpretation so as tomap to each field in a frame format stipulated by the CAN protocol. Avalue that is determined to be an ID field is transferred to the anomalyframe detecting unit 113. In a case where determination is made that aframe is not following the CAN protocol, notification is made to theframe generating unit 114 to transmit an error frame. In a case ofhaving received an error frame, i.e., in a case of having interpretedthat a received frame is an error frame from the value thereof, the restof the frame is discarded, i.e., interpreting of the frame is canceled.

The frame generating unit 114 configures an error frame following thenotification instructing transmission of an error frame that has beennotified from the frame interpreting unit 115, and notifies the frametransmission/reception unit 116 of the error frame and causestransmission thereof. The frame generating unit 114 configures an errorframe following the notification instructing transmission of an errorframe that has been notified from the anomaly frame detecting unit 113,and notifies the frame transmission/reception unit 116 of the errorframe and causes transmission thereof.

The whitelist storing unit 112 stores a whitelist (see FIG. 5)stipulating CAN message IDs included in a valid frame transmitted overthe CAN bus 100. The whitelist also includes conditions used todetermine whether or not CAN messages are unauthorized, for each CANmessage ID.

The anomaly frame detecting unit 113 has a function of determiningwhether or not a frame acquired from the CAN bus 100 is unauthorized ornot, based on rules identified by the whitelist that the whiteliststoring unit 112 stores. Specifically, the anomaly frame detecting unit113 receives the value (CAN message ID) of the ID field notified fromthe frame interpreting unit 115, and in a case where the CAN message IDis not in the whitelist or does not satisfy conditions set in thewhitelist corresponding to that CAN message ID, determines that this isunauthorized and notifies the frame generating unit 114 to transmit anerror frame. Note that in this case, the bit values of the CAN messagedetermined to be unauthorized are overwritten by the error frame made upof consecutive dominants being given priority over recessives. Theanomaly frame detecting unit 113 notifies the anomaly informationnotifying unit 111 of the contents of the anomaly detection, that arethe contents of the CAN message determined to be unauthorized(unauthorized frame). The anomaly information notifying unit 111notifies the level interpreting unit 120 of anomaly informationindicating the content of the anomaly detection.

1.5 Whitelist

FIG. 5 is a diagram illustrating an example of a whitelist that thewhitelist storing unit 112 within the anomaly detection ECU 110 stores.The whitelist 1120 is data where data length 1122, data range 1123, andcycle 1124 have been correlated for each ID (CAN message ID) 1121.

The CAN message ID 1121 indicates valid CAN message IDs that have beendetermined to be permissible as a vehicle specification to be sent outonto the CAN bus 100 onto the onboard network.

The data length 1122 is the DLC (see FIG. 3), and indicates the validdata length determined by the specification for the CAN message of thecorresponding CAN message ID.

The data range 1123 indicates the data range expected for the content ofa valid data field determined by the specification for the CAN messageof the corresponding CAN message ID.

The cycle 1124 indicates a valid cycle determined by the specification,in a case where the CAN message of the corresponding CAN message ID is aperiodic message transmitted periodically.

The example in FIG. 5 illustrates that a CAN message of ID “0x100”relating to speed that satisfies the conditions of data length of eightbytes, data range of 0 through 180, and a cycle of 10 ms, is a valid CANmessage. Also illustrated is that a CAN message of ID “0x200” relatingto engine rotations that satisfies the conditions of data length ofeight bytes, data range of 0 through 10000, and a cycle of 10 ms, is avalid CAN message. Also illustrated is that a CAN message of ID “0x300”relating to traveling distance that satisfies the conditions of datalength of eight bytes, data range of 0 through 9999999, and a cycle of20 ms, is a valid CAN message. Further illustrated is that a CAN messageof ID “0x400” relating to door open/closed state that satisfies theconditions of data length of one byte, data range of 0 or 1, and a cycleof 1000 ms, is a valid CAN message. The anomaly detection ECU 110determines that a CAN message that does not match the conditions for theCAN message IDs in the whitelist 1120 is an unauthorized CAN message.

1.6 Anomaly Detection Sequence

FIG. 6 is a sequence diagram illustrating an operation example of theanomaly detection ECU 110 detecting an unauthorized frame (i.e., anunauthorized CAN message). The sequences are illustrated by processingprocedures (steps) at each device. The operations of the anomalydetection ECU 110 and the ECUs 101 through 103 in a case where anunauthorized ECU is connected to the CAN bus 100 and a frame (CANmessage) where the CAN message ID is “0x100” and data is “255 (0xFF)” istransmitted will be described below with reference to FIG. 6.

First, the unauthorized ECU starts transmission of the data frame wherethe message ID is “0x100” and data is “255 (0xFF)” (step S101). Thevalues of the bits making up the frame are sequentially sent out ontothe CAN bus 100 in the order of SOF, ID field (message ID), and soforth, following the above-described data frame format.

When the unauthorized ECU has ended sending up to the ID field (CANmessage ID) onto the CAN bus 100, the anomaly detection ECU 110 and theECUs 101 through 103 each receive the CAN message ID (step S102).

The ECUs 101 through 103 each check whether or not a CAN message ID toreceive, using the stored reception ID list, and the anomaly detectionECU 110 checks the CAN message ID to determine whether or not anunauthorized CAN message, using the whitelist (see FIG. 5) (step S103).In the example in FIG. 6, the ECU 101 and ECU 102 end reception, since“0x100” is not a CAN message ID to be received. The ECU 103 continuesreception, since “0x100” is a CAN message ID to be received. The anomalydetection ECU 110 continues reception, since the CAN message ID “0x100”is in the whitelist.

The anomaly detection ECU 110 determines whether or not the CAN messagethat has appeared on the CAN bus 100 is being transmitted at the validcycle that the whitelist indicates (step S104). In a case where this isnot a valid cycle, the flow transitions to step S108 and error frametransmission is performed.

Next, the anomaly detection ECU 110 determines whether or not the CANmessage that has appeared on the CAN bus 100 satisfies the valid datasize (DLC) conditions that the whitelist indicates (step S105). In acase where this is not a valid data size, the flow transitions to stepS108 and error frame transmission is performed.

Next, the anomaly detection ECU 110 determines whether or not the CANmessage that has appeared on the CAN bus 100 satisfies the valid datarange conditions that the whitelist indicates (step S106). In a casewhere the valid data range conditions are satisfied, the anomalydetection ECU 110 ends processing. In the example in FIG. 6, thereceived data is “255 (0xFF)” which is outside of the data range in thewhitelist, so a frame generated toward broadcasting of an error frame(i.e., transmitting over the CAN bus 100).

While the anomaly detection ECU 110 determines whether or not the CANmessage is unauthorized using the whitelist, the ECU 103 continues toreceive the data frame (step S107).

In a case where the anomaly detection ECU 110 has determined that theCAN message is unauthorized from the distinguishing performed in stepsS103 through S106, an error frame is broadcast (transmitted) (stepS108). The ECU 103 receives this error frame, and cancels reception ofthe data frame (step S109).

The anomaly detection ECU 110 notifies anomaly information indicatingthe content of the CAN message determined to be unauthorized, to thelevel interpreting unit 120 (step S110).

1.7 Level Information

FIG. 7 illustrates an example of level information 1200 that the levelinterpreting unit 120 stores. The level information 1200 is informationcorrelating a function type 1201, ID (CAN message ID) 1202, and level1203.

The function type 1201 indicates a function type determined byclassifying the function of the ECU transmitting the CAN message.Examples of classification of ECU functions include drive-relatedfunctions, chassis-related functions, body-related functions,safety/comfort functions, ITS-related functions, telematics-relatedfunctions, infotainment-related functions, and so forth. Thedrive-related functions are functions related to “driving” (traveling)of the vehicle, such as control of the engine, electric motors, fuel,battery, transmission, and so forth. The chassis-related functions arefunctions relating to control of behavior and so forth of the vehiclesuch as “turning” and “stopping” and so forth, by the brakes, steering,and so forth. The body-related functions are functions relating tocontrol of equipment of the vehicle such as door locks, airconditioning, lights, turn indicators, and so forth. The safety/comfortfunctions are functions for automatically realizing safe and comfortabledriving, such as automatic braking, lane keeping functions,inter-vehicle distance keeping functions, collision-preventionfunctions, airbags, and so forth. The ITS-related functions arefunctions handling freeway traffic systems such as Electronic TollCollection System (ETC) and so forth. The telematics-related functionsare functions handling services using mobile telecommunication. Theinfotainment-related functions are entertainment functions relating toautomotive navigation, audio, and so forth.

The CAN message ID 1202 indicates the ID of the CAN message (CAN messageID) set to be transmitted by the ECU belonging to the correspondingfunction type 1201. The level 1203 indicates the security level of thelevel determined beforehand in light of safety and so forth of thevehicle in a case where the ECU is unauthorizedly controlled, inaccordance with the nature of the function of the ECU belonging to thecorresponding function type 1201. For example, 1 through 4 represent avalue of one out of four stages. Here, the higher the security level is,the more safety is affected. In the example in FIG. 7, the drive-relatedfunctions and chassis-related functions relate to basic functions suchas “driving”, “turning”, and “stopping”, so the security level is set to4 which is high, since in a case where an ECU bearing these functions isunauthorizedly controlled, it is conceivable that accidents with othervehicles will readily occur. On the other hand, in a case where an ECUbearing infotainment-related functions is unauthorizedly controlled, itis unlikely that this will directly influence whether or not an accidentwill occur, so the security level is set to 1, which is low.

1.8 Inter-Vehicle Communication Message Format

The inter-vehicle communication message 300 is used as an anomalydetection notification to make notification to the effect among vehiclesthat an anomaly has been detected. FIG. 8 is a diagram illustrating anexample of the configuration of the inter-vehicle communication message300. The format of the inter-vehicle communication message 300 isconfigured including a common application header portion, a commonapplication data portion, a free application header portion, and a freeapplication data portion. FIG. 8 illustrates an example, were, in a casewhere the anomaly detection ECU 110 detects an anomaly in the vehicle,the free application data portion is used to convey to the effect thatan anomaly has been detected, and in a case of performing communicationfor other usages, the free application data portion is used according todifferent formats determined for each usage.

The common application header portion is configured of a commonapplication header information 301, the common application headerinformation 301 including size information of the common applicationdata portion.

The common application data portion includes a clock time information302, a position information 303, a vehicle state information 304, andvehicle attributes information 305.

The clock time information 302 indicates clock time information of year,month, day, hour, minute, and second.

The position information 303 is information indicating the position ofthe vehicle acquired by a GPS receiver or the like, such as latitude,longitude, and altitude.

The vehicle state information 304 is information of vehicular speed, thebearing angle of the vehicle, forwards-backwards acceleration, gearshiftposition, steering angle, and so forth.

The vehicle attributes information 305 includes information of thevehicle class, such as large vehicles, passenger cars, motorcycles, andso forth, usage type such as private vehicle, emergency vehicle, roadmaintenance vehicle, and so forth, vehicle size such as breadth andlength and height, and so forth.

The free application header portion is configured of a free applicationheader information 306, the free application header information 306including information such as size, offset, and so forth, of the freeapplication data portion.

The free application data portion indicates information relating toanomaly detection, and is configured including a level information 307,an unauthorized vehicle position information 308, and a signature data309.

The level information 307 indicates a level (security level)corresponding to the unauthorized CAN message (content of anomalydetection) that the anomaly detection ECU 110 has detected, asillustrated in FIG. 7.

The unauthorized vehicle position information 308 is positioninformation indicating the location at the time of anomaly detection,which has been measured regarding the vehicle where the anomalydetection ECU 110 has detected an anomaly (i.e., the vehicle in which isinstalled the anomaly detection ECU that has detected the anomaly).

The signature data 309 is an electronic signature for the inter-vehiclecommunication message 300.

1.9 Anomaly Detection Sequence

FIG. 9 is a sequence diagram illustrating an operation example of eachpart of the vehicle 10 up until transmitting an inter-vehiclecommunication message 300 to the to the vehicle 20 (vehicle B) in a casewhere an anomaly has been detected at the vehicle 10 (vehicle A).

In a case of having detected an unauthorized CAN message, the anomalydetection ECU 110 of the vehicle 10 (vehicle A) notifies the levelinterpreting unit 120 of anomaly information including the frame ID (CANmessage ID) of the unauthorized CAN message, that is the content of theanomaly detection (step S201).

The level interpreting unit 120 of the vehicle 10 that has receivednotification of the anomaly information identifies the level (securitylevel) according to the CAN message ID that the anomaly informationindicates, and sets level information indicating that level, based onthe level information 1200 that it stores (step S202). That is to say,the level information indicates one level that has been selected, fromthe multiple levels predetermined by dividing CAN message IDs, based onthe CAN message ID of the unauthorized frame (unauthorized CAN message).

The level interpreting unit 120 notifies the set level information tothe inter-vehicle communication message authentication unit 130 of thevehicle 10 (step S203).

The inter-vehicle communication message authentication unit 130 of thevehicle 10 that has received the notification of level informationacquires current position information of the vehicle 10 from theposition information acquisition unit 190, and forms an inter-vehiclecommunication message 300 by setting this position information and thelevel information regarding which notification has been received.

Next, the inter-vehicle communication message authentication unit 130 ofthe vehicle 10 affixes an electronic signature to the inter-vehiclecommunication message 300 using the vehicle A secret key 1301 (stepS205). The inter-vehicle communication message authentication unit 130notifies the inter-vehicle communication message 300 to which theelectric signature has been affixed to the inter-vehicle communicationmessage transmission/reception unit 140 of the vehicle 10 (step S206).

The inter-vehicle communication message transmission/reception unit 140of the vehicle 10, which has received the notification of theinter-vehicle communication message 300, transmits the inter-vehiclecommunication message 300 and the vehicle A public key certificate 1302to the vehicle 20 (vehicle B) by inter-vehicle communication. Note thattransmission of the inter-vehicle communication message 300 from thevehicle 10 (vehicle A) to the vehicle 20 (vehicle B) does notparticularly identify the target vehicle. Accordingly, the inter-vehiclecommunication message 300 is broadcast to unspecified vehicles by acommunication method that can be propagated backwards from the vehicleA.

1.10 Handling Information (Safety State List)

FIG. 10 is a diagram illustrating handling information (safety statelist) that the level interpreting unit 120 references. The handlinginformation (safety state list) is information correlating which anomalyhandling processing out of a plurality of anomaly handling processingdetermined beforehand should be executed to transition to which safetystate, at the time of a vehicle which has received the inter-vehiclecommunication message 300 performing anomaly handling processing toeffect control to transition to a safety state in accordance with thelevel (security level) indicated by the level information within theinter-vehicle communication message 300.

Handling information (safety state list) 2400 is configured with a level2401 and an anomaly handling processing 2402 correlated for each ofmultiple level 2401 values (security levels). The level 2401 indicatesthe same security level as the level 1203 in the level informationillustrated in FIG. 7.

The anomaly handling processing 2402 is information for identifying theanomaly handling processing for performing control to transition to asafe state, set corresponding to each security level. In the example inthe handling information in FIG. 10, in a case where the security levelis “1”, anomaly handling processing for control of notifying the driverof the vehicle is correlated. In a case where the security level is “2”,anomaly handling processing for control of driving while maintaininginter-vehicle distance between the vehicle and the vehicle ahead withina predetermined range is correlated. In a case where the security levelis “3”, anomaly handling processing for control proceeding slowly iscorrelated. In a case where the security level is “4”, anomaly handlingprocessing for control of stopping the vehicle is correlated. Control ofnotifying the driver of the vehicle is, for example, control ofdisplaying a message on a display screen used for the automotivenavigation or the like, to notify and alert the driver, or control tonotify the driver by causing a light-emitting diode (LED) on theinstrument panel within the vehicle to light, or the like. It ispreferable that consideration be given to suppression of adverse effectson the traffic system in the correlation of the handling information2400 so that traffic congestion is not caused in a case of havingdetected an anomaly regarding which it is conceivable that thelikelihood of directly influencing occurrence of accidents is small.

1.11 Transition Sequent to Safe State Corresponding to Anomaly DetectionNotification

FIG. 11 is a sequence diagram illustrating operations of the parts up totransitioning to a safe state in the vehicle 20 (vehicle B) that hasreceived an inter-vehicle communication message from the vehicle 10(vehicle A). The inter-vehicle communication messagetransmission/reception unit 240 of the vehicle 20 (vehicle B) receivesthe inter-vehicle communication message 300 as an anomaly detectionnotification and the vehicle A public key certificate 1302 from thevehicle 10 (vehicle A) (step S301).

Next, the inter-vehicle communication message transmission/receptionunit 240 of the vehicle 20 notifies the inter-vehicle communicationmessage authentication unit 230 of the inter-vehicle communicationmessage 300 and the vehicle A public key certificate 1302 (step S302).

The inter-vehicle communication message authentication unit 230 of thevehicle 20 uses the public key of the CA certificate 1300 to verify thesignature of the received vehicle A public key certificate 1302, andthen uses the vehicle A public key certificate 1302 to verify thesignature of the received inter-vehicle communication message 300 (stepS303). If the signature verification fails, the processing ends. If thesignature verification is successful, the level interpreting unit 220 isnotified of the level information in the inter-vehicle communicationmessage 300.

The level interpreting unit 220 of the vehicle 20 references thehandling information (safety state list) illustrated in FIG. 10,identifies (determines) which anomaly handling processing to executed totransition to which safety state, in accordance with the level (securitylevel) that the level information in the inter-vehicle communicationmessage 300 indicates (step S304), and notifies the vehicular safetystate instruction unit 250 of an execution instruction of that anomalyhandling processing (request to transition to the safe state) (stepS305). The anomaly handling processing is performed in these steps S305through S311.

The vehicular safety state instruction unit 250 of the vehicle 20executes the anomaly handling processing to transition to a safe state,and requests the external state determining unit 260 for determinationregarding the situation outside of the vehicle as necessary (step S306).

The external state determining unit 260 acquires information fromvarious types of sensors such as the onboard camera 270 and laser radar280 and the like (steps S307, S308), determines the situation around thevehicle 20 by analyzing the acquired information (step S309), andnotifies the vehicular safety state instruction unit 250 of informationso that the vehicle can be appropriately transitioned to the safe state(step S310).

The vehicular safety state instruction unit 250 of the vehicle 20 usesinformation from the external state determining unit 260 as necessary tomaintain execution of the anomaly handling processing, therebycontrolling the vehicle 20 so as to transition to a safe state (stepS311). Accordingly, appropriate transition of the vehicle 20 (vehicle B)to a safe state is realized in accordance with the security levelindicated by the inter-vehicle communication message 300 serving as theanomaly detection notification that the vehicle 10 (vehicle A) hastransmitted.

1.12 Advantages of First Embodiment

As described above, the anomaly handling method that the inter-vehiclecommunication system uses according to the first embodiment is ananomaly handling method that handles an unauthorized situation byperforming inter-vehicle communication between a vehicle A (firstvehicle) and a vehicle B (second vehicle), for example. Now, in a casewhere an unauthorized frame is detected on the onboard network installedin the vehicle A (first vehicle), a device (e.g., an ECU or the like)installed in the vehicle A transmits an anomaly detection notification,one or multiple ECUs installed in the vehicle B (second vehicle)receives the anomaly detection notification, selects anomaly handlingprocessing from multiple predetermined anomaly handling processings inaccordance with the content of the anomaly detection notification thathas been received, and executes the selected anomaly handlingprocessing. In a state where an unauthorized frame has been detectedthere is a high possibility that the vehicle will be unauthorizedlycontrolled, so the effect of the unauthorized control can be suppressedby notifying other vehicles. More specifically, At the time of detectionof the unauthorized frame, the device installed in the vehicle Aincludes level information, indicating one level selected from multiplepredetermined levels where frame IDs have been divided, based on theframe ID of the unauthorized frame, in the anomaly detectionnotification and transmits the anomaly detection notification. The oneor multiple ECUs installed in the vehicle B select the anomaly handlingprocessing in accordance with the level that the level informationincluded in the received anomaly detection notification indicates, andtransitions to a safe state by execution of the selected anomalyhandling processing.

According to the anomaly handling method used by such an inter-vehiclecommunication system, even in a situation where a vehicle (vehicle A)that is traveling ahead is about to be unauthorizedly controlled by anunauthorized CAN message on the internal onboard network of the vehicleA, the vehicle A notifies vehicles following behind itself. A vehicle(vehicle B) behind, that has received the anomaly detectionnotification, can transition to a safe state in accordance with thelevel (security level) indicated by the anomaly detection notification,and appropriate handling can be performed in accordance with thesituation. Accordingly, an accident or the like where the vehicle Bwould be involved can be prevented from occurring. Also, the levelindicated as the anomaly detection notification can be set beforehand inlight of the degree of effect of the unauthorized CAN message detectedin the onboard network, for example, and the safe state to whichtransmission is to be made corresponding to that level can be setbeforehand taking into consideration suppression of adverse effects onthe traffic system, for example. Thus, A vehicle that has received ananomaly detection notification can transmission to a safe state that isappropriate for the situation.

Second Embodiment

A partial modification of the above-described inter-vehiclecommunication system will be described below as a second embodiment ofthe present disclosure. An example has been illustrated in the anomalyhandling method of the inter-vehicle communication system described inthe first embodiment, where an anomaly detection notification relatingto an anomaly having been detected at the vehicle 10 (vehicle A) istransmitted to one vehicle 20 (vehicle B) behind the vehicle 10. Incomparison with this, the inter-vehicle communication system accordingto the present embodiment can transfer the anomaly detectionnotification, as an anomaly handling method. That is to say, theinter-vehicle communication system according to the present embodimentperforms anomaly detection notification transmission so that multiplevehicles following behind the vehicle 10 (vehicle A) can receive, by thevehicle 10 (vehicle A) transmitting an anomaly detection notificationrelating to a detected anomaly and vehicles which have received thisanomaly detection notification transferring this anomaly detectionnotification under certain conditions. The configuration of theinter-vehicle communication system according to the second embodiment(e.g., components of the vehicles, etc.) are the same as thoseillustrated in the first embodiment, so description thereof will beomitted, and parts which differ from the first embodiment will bedescribed here.

2.1 Transfer of Inter-Vehicle Communication Message

FIG. 12 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages as anomalydetection notifications to vehicles following behind. The vehicles whichhave received the inter-vehicle communication message serving as ananomaly detection notification determine whether or not predeterminedconditions (transfer conditions) are satisfied, and in a case of havingdetermined that these are satisfied, transmits (transfers) the anomalydetection notification externally from the vehicles. Transfer conditionsare conditions relating to whether or not to transfer, and in theexample in FIG. 12, this is a condition that the distance from thevehicle which has detected the anomaly is less than 500 m.

In this example, the vehicle 10 (vehicle A) detects an anomaly, andtransmits an inter-vehicle communication message 300 a from the vehicleA to other vehicles as an anomaly detection notification. The vehicle 20(vehicle B) following behind the vehicle A receives the inter-vehiclecommunication message 300 a from the vehicle A, and in order to transferinformation relating to the anomaly detection included in theinter-vehicle communication message 300 a (level information indicatinglevel 4 in the example in FIG. 12 and so forth) to other vehicles,transmits an inter-vehicle communication message 300 b includinginformation relating to that anomaly detection. A vehicle 30 (vehicle C)following behind the vehicle B receives the inter-vehicle communicationmessage 300 b from the vehicle B, and in order to transfer informationrelating to the anomaly detection included in the inter-vehiclecommunication message 300 b to other vehicles, transmits aninter-vehicle communication message 300 c including information relatingto that anomaly detection. A vehicle 40 (vehicle D) following behind thevehicle C receives the inter-vehicle communication message 300 c fromthe vehicle C. The vehicle D is 500 m away from the vehicle A, and doesnot satisfy the transfer condition of the distance to the vehicle thathas detected the anomaly being less than 500 m, so transfer is notperformed. Note that the vehicle C and vehicle D basically have the sameconfiguration as the vehicle B.

2.2 Inter-Vehicle Communication Message Format

FIG. 13 is a diagram illustrating an example of the configuration of theinter-vehicle communication message according to the present embodiment.The inter-vehicle communication message 300 a according to the presentembodiment (as well as the inter-vehicle communication messages 300 band 300 c) has a configuration where condition information 310indicating transfer conditions has been added to the configuration ofthe inter-vehicle communication message 300 illustrated in the firstembodiment (see FIG. 8). Accordingly, the range over whichretransmission (transfer) will be performed can be restricted.

The transfer condition that the condition information 310 indicates is acondition regarding distance from the vehicle where the anomalydetection has been made, and for example is a condition where thedistance between a position measured regarding one vehicle and aposition that the position information (unauthorized vehicle positioninformation 308) included in the received anomaly detection notificationindicates are within a certain range. The condition information 310indicates that the distance as to the vehicle where the anomalydetection has been made is less than 500 m or the like, in a specificexample. In this case, in a case where the vehicle that has received theinter-vehicle communication message 300 a or the like is less than 500 maway from the vehicle where the anomaly detection has been made,transfer is performed. Note that the position of the vehicle where theanomaly detection has been made is indicated by the unauthorized vehicleposition information 308 within the inter-vehicle communication message300 a. Accordingly, the vehicle which has received the inter-vehiclecommunication message 300 a (e.g., the vehicle 20) calculates thedistance between the position of the vehicle A where the anomalydetection has been made as indicated by the unauthorized vehicleposition information 308, and the position of the own vehicle detectedby the position information acquisition unit 290 (see FIG. 2) forexample, and determines whether or not to retransmit (transfer) theinter-vehicle communication message 300 a based on the transfercondition indicated by the condition information 310. Note that transferof the inter-vehicle communication message 300 a includes transferringwith part of the contents of the inter-vehicle communication message 300a having been changed (i.e., transfer of the inter-vehicle communicationmessage 300 b). Specific values of the signature data 309, commonapplication data portion, and so forth, in the inter-vehiclecommunication messages 300 a and 300 b may be different for eachvehicle. However, the specific values of the level information 307, theunauthorized vehicle position information 308, and the conditioninformation 310, in the inter-vehicle communication messages 300 a and300 b, remain the same.

2.3 Transfer Sequence of Anomaly Detection Notification

FIGS. 14 and 15 are sequence diagrams illustrating operations of theparts in a case of a vehicle receiving and transferring an inter-vehiclecommunication message. An example will be described here regarding acase where the vehicle 20 (vehicle B) receives an inter-vehiclecommunication message as an anomaly detection notification from thevehicle 10 (vehicle A). Step S401 through step S411 are the same as stepS301 through step S311 (see FIG. 11) described in the first embodiment,so description will be omitted.

The level interpreting unit 220 of the vehicle B in step S412 referencethe transfer conditions that the condition information 310 in theinter-vehicle communication message 300 a, including the levelinformation 307 referenced in step S404, indicates, and determineswhether or not the transfer conditions are satisfied. That is to say,the level interpreting unit 220 acquires the position of its own vehiclefrom the position information acquisition unit 290, references theunauthorized vehicle position information 308 in the inter-vehiclecommunication message 300 a, and calculates the distance between thevehicle A where the anomaly has been detected to its own vehicle. In acase where the calculated distance satisfies the transfer condition, thelevel interpreting unit 220 hands over to the inter-vehiclecommunication message authentication unit 230 so that information thesame as the level information 307, unauthorized vehicle positioninformation 308, and condition information 310 included in theinter-vehicle communication message 300 a can be set to the levelinformation 307, unauthorized vehicle position information 308, andcondition information 310 in the inter-vehicle communication message 300b, and requests a signature (step S413). In a case where the transfercondition is not satisfied, the vehicle B does not perform the transferand ends the processing.

The inter-vehicle communication message authentication unit 230 that hasbeen requested for a signature in step S413 forms the inter-vehiclecommunication message 300 b by setting the information handed to thelevel interpreting unit 220, generates an electronic signature using thevehicle B secret key 2301, and includes this in the inter-vehiclecommunication message 300 b as signature data 309 (step S414).

The inter-vehicle communication message authentication unit 230 thencommunicates the inter-vehicle communication message 300 b to which theelectronic signature has been affixed to the inter-vehicle communicationmessage transmission/reception unit 240 of vehicle B, and requeststransmission (step S415).

Next, the inter-vehicle communication message transmission/receptionunit 240 transmits the inter-vehicle communication message 300 b and thevehicle B public key certificate 2302 to the vehicle 30 (vehicle C)following behind by inter-vehicle communication. In the same way as withthe anomaly detection notification from vehicle A to vehicle B byinter-vehicle communication message 300 a, the transmission of theinter-vehicle communication message 300 b to serve as transfer of theanomaly detection notification from the vehicle B to vehicle C does notidentify the vehicle C as the recipient of the transmission inparticular. Accordingly, the inter-vehicle communication message 300 bis broadcast to unspecified vehicles by a communication method that canbe propagated backwards from the vehicle B.

In the same way as with the above-described vehicle B, transfer of theanomaly detection notification is performed in a case where the transferconditions indicated by the received inter-vehicle communication messageare satisfied at other vehicles (e.g., vehicle C following behind thevehicle B), and transfer is not performed in a case where the transferconditions are not satisfied.

2.4 Advantages of Second Embodiment

According to the anomaly handling method used by the inter-vehiclecommunication system of the second embodiment, in addition to theadvantages yielded by the inter-vehicle communication system of thefirst embodiments, multiple vehicles following being the vehicle wherethe anomaly has been detected can transition to a safe state.Accordingly, a large accident where three or more vehicles are involvedcan be prevented, for example.

Third Embodiment

A partial modification of the inter-vehicle communication systemdescribed in the second embodiment will be described below as a thirdembodiment of the present disclosure. In the anomaly handling methodused in the inter-vehicle communication system according to the presentembodiment, the content of level information, which is part ofinformation relating to anomaly detection in an anomaly detectionnotification (inter-vehicle communication message) is changed andtransferred. Points of the inter-vehicle communication system accordingto the third embodiment that are the same as in the first embodiment andsecond embodiment described above will be omitted from description, andpoints that differ will be described here.

3.1 Inter-Vehicle Communication Message Format

FIG. 16 is a diagram illustrating an example of the configuration of theinter-vehicle communication message according to the third embodiment.An inter-vehicle communication message 300A according to the presentembodiment has a configuration where a reset level information 311, anda level changing conditions 312 indicating predetermined level changingrules that are rules for updating the reset level information, have beenadded to the configuration of the inter-vehicle communication message300 a (see FIG. 13) described in the second embodiment. Accordingly, thesecurity level can be changed when retransmitting (transferring) aninter-vehicle communication message, and transmission thus performed.

The reset level information 311 has set therein a value (level) to whichthe security level, indicated by the level information 307 set at thevehicle where the anomaly detection has been made, has been changed, inaccordance with the level changing conditions 312 at the time of avehicle that has received an inter-vehicle communication messageretransmits (transfers) the inter-vehicle communication message toanother vehicle. Note that the vehicle A where the anomaly detection hasbeen made sets the same value as the level information 307 to the resetlevel information 311 of the inter-vehicle communication message 300A.

3.2 Level Changing Conditions 312

FIG. 17 is a diagram illustrating an example of the level changingconditions 312. In the example in FIG. 17, the level changing conditions312 indicating predetermined level changing rules show the contents ofchange (level change contents) in accordance with the conditions forchanging the level (distance to unauthorized vehicle), in particular.

The vehicle which has received the inter-vehicle communication message300A calculates the distance between the unauthorized vehicle and itsown vehicle from the position of its own vehicle and the unauthorizedvehicle (i.e., the vehicle A regarding which the anomaly has beendetected), and compares the calculated distance with the conditions thatthe level changing conditions 312 indicates to change the level, wherebythe value to which the reset level information 311 should be set can beidentified in accordance with that distance.

In the example in FIG. 17, if the distance to the unauthorized vehicleis less than 100 m, the reset level information 311 set at theunauthorized vehicle is maintained without being changed at the time oftransfer. For example, “level 4” is set in the level information 307 inthe inter-vehicle communication message that a vehicle at a positionwhere the distance to the unauthorized vehicle is less than 100 m hastransmitted, and the same value “level 4” is also set in the reset levelinformation 311 as well.

Also, in the example in FIG. 17, the level changing contents in a casewhere the distance as to the unauthorized vehicle is 100 m or more butless than 300 m is shown to lower the reset level information 311 by 1(decremented by 1) from the level information 307 set at theunauthorized vehicle. For example, in an inter-vehicle communicationmessage transmitted (transferred) from a vehicle at a position 100 m ormore but less than 300 m from the unauthorized vehicle, “level 4” is setin the level information 307, and “level 3” that has been decremented by1 is set in the reset level information 311.

The example in FIG. 17 also shows that the level changing contents in acase where the distance as to the unauthorized vehicle is 300 m or morebut less than 500 m lower the reset level information 311 by 2(decremented by 2) from the level information 307 set at theunauthorized vehicle. For example, in an inter-vehicle communicationmessage transmitted (transferred) from a vehicle at a position 300 m ormore but less than 500 m from the unauthorized vehicle, “level 4” is setin the level information 307, and “level 2” that has been decremented by2 is set in the reset level information 311.

Although description has ben made in the second embodiment that eachvehicle that has received an inter-vehicle communication messageexecutes anomaly handling processing to transition to a safe state inaccordance with the level (security level) that the level information307 indicates, in the present embodiment each vehicle that has receivedthe inter-vehicle communication message executes anomaly handlingprocessing to transition to a safe state in accordance with the levelset to the reset level information 311 (security level).

3.3 Transmission of Inter-Vehicle Communication Message

FIG. 18 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages as anomalydetection notifications to vehicles following behind. The vehicles thathave received an inter-vehicle communication message as an anomalydetection notification changes the reset level information 311 inaccordance with the level changing conditions 312 in anomaly detectionin a case where the transfer conditions are satisfied, and transmits theanomaly detection notification. The example in FIG. 18 is an example ofperforming retransmission (transfer) of the anomaly detectionnotification using the level changing conditions 312 exemplarilyillustrated in FIG. 17. There may be cases where the inter-vehiclecommunication message is transmitted with one or more other vehiclesbeing included between the vehicle 10 (vehicle A) and the vehicle 20(vehicle B). There also may be cases where the inter-vehiclecommunication message is transmitted with one or more other vehiclesbeing included between the vehicle B and the vehicle 30 (vehicle C).

In the example in FIG. 18, the vehicle A has detected an anomaly on theonboard network, set the level information 307 and reset levelinformation 311 to “level 3” in accordance with the content of theanomaly, and transmitted the inter-vehicle communication message 300A.Inter-vehicle communication messages 300B through 300E also areconfigured having the same format as the inter-vehicle communicationmessage 300A (see FIG. 16). For example, the inter-vehicle communicationmessage 300A is transmitted from another vehicle and is received at thevehicle B as inter-vehicle communication message 300B.

The vehicle B that is 100 m away from the position of the vehicle Afalls under the condition of distance or 100 m or more but less than 300m to the unauthorized vehicle, based on the level changing conditions312 of the inter-vehicle communication message 300B, so the reset levelinformation 311 is decremented from the level information 307 set at theunauthorized vehicle by 1, and the inter-vehicle communication message300C where the reset level information 311 has been set to “level 2” istransmitted. For example, the inter-vehicle communication message 300Cis transmitted from another vehicle and is received at the vehicle C asinter-vehicle communication message 300D.

The vehicle C that is 300 m away from the position of the vehicle Afalls under the condition of distance or 300 m or more but less than 500m to the unauthorized vehicle, based on the level changing conditions312 of the inter-vehicle communication message 300D, so the reset levelinformation 311 is decremented from the level information 307 set at theunauthorized vehicle by 2, and the inter-vehicle communication message300E where the reset level information 311 has been set to “level 1” istransmitted.

The vehicle 40 (vehicle D) is at a position 500 m away from theunauthorized vehicle, and does not satisfy the transfer condition of“less than 500 m” that the condition information 310 in theinter-vehicle communication message 300E indicates, so retransmission(transfer) of the inter-vehicle communication message is not performed.

3.4 Transfer Sequence of Anomaly Detection Notification

FIGS. 19 and 20 are sequence diagrams illustrating operations of theparts in a case of a vehicle receiving and transferring an inter-vehiclecommunication message with the level information changed under certainconditions. An example will be described here regarding a case where thevehicle 20 (vehicle B) receives an inter-vehicle communication message Btransmitted from the vehicle 10 (vehicle A) and transferred at anothervehicle as an anomaly detection notification.

Step S501 through step S511 are the same as step S301 through step S311(see FIG. 11) described in the first embodiment, so description will beomitted. Note, however, that in step S504, the level interpreting unit220 of the vehicle B references the handling information (safety statelist) shown in FIG. 10, identifies which anomaly handling processingshould be executed to transition to which safety state, in accordancewith the level (security level) that the reset level information 311 inthe inter-vehicle communication message 300B indicates, and notifies thevehicular safety state instruction unit 250 of the execution instructionof that anomaly handling processing (request to transition to safestate) (step S505).

The level interpreting unit 220 of the vehicle B in step S512 referencethe transfer conditions that the condition information 310 in theinter-vehicle communication message 300B, including the reset levelinformation 311 referenced in step S504, indicates, and determineswhether or not the transfer conditions are satisfied. In a case wherethe transfer conditions are satisfied, the level interpreting unit 220references the content of level change corresponding to the conditionsthat the own vehicle falls under, out of the conditions indicated by thelevel changing conditions 312 in the inter-vehicle communication message300B, determines whether or not level change is necessary (step S513),and only in a case where determination is made that level change isnecessary is the reset level information 311 lowered in accordance withthe contents of the level change (step S514). The level interpretingunit 220 then hands over to the inter-vehicle communication messageauthentication unit 230 so that information the same as the levelinformation 307, unauthorized vehicle position information 308,condition information 310, and level changing conditions 312 included inthe inter-vehicle communication message 300B can be set to the levelinformation 307, unauthorized vehicle position information 308,condition information 310, and level changing conditions 312 in theinter-vehicle communication message 300C, and so that the reset levelinformation 311 of which the level value has been maintained ordecremented in accordance with the determination made in step S513 canbe set to the reset level information 311 of the inter-vehiclecommunication message 300C, and requests a signature (step S515). In acase where the transfer condition is not satisfied, the vehicle B doesnot perform the transfer and ends the processing.

The inter-vehicle communication message authentication unit 230 that hasbeen requested for a signature in step S515 forms the inter-vehiclecommunication message 300C by setting the information handed to thelevel interpreting unit 220, generates an electronic signature using thevehicle B secret key 2301, and includes this in the inter-vehiclecommunication message 300C as signature data 309 (step S516).

The inter-vehicle communication message authentication unit 230 thennotifies the inter-vehicle communication message 300C to which theelectronic signature has been affixed to the inter-vehicle communicationmessage transmission/reception unit 240 of the vehicle B, and requeststransmission (step S517).

Next, the inter-vehicle communication message transmission/receptionunit 240 transmits the inter-vehicle communication message 300C and thevehicle B public key certificate 2302 to the other vehicles byinter-vehicle communication so as to be propagated (step S518).

3.5 Advantages of Third Embodiment

According to the anomaly handling method used by the inter-vehiclecommunication system of the third embodiment, the farther a vehiclefollowing behind the unauthorized vehicle is from the unauthorizedvehicle, the lower the level relating to anomaly detection notification(security level indicated by the reset level information). Accordingly,adverse effects on the traffic system (e.g., occurrence of trafficcongestion, etc.) can be suppressed by transitioning to a safe state byanomaly handling processing at vehicles that have received the anomalydetection notification.

Fourth Embodiment

Although an example of inter-vehicle communication has been illustratedin the above-descried first through third embodiments, this may beroad-vehicle communication between a vehicle and a roadside deviceinstalled at the road. A fourth embodiment of the present disclosureillustrates the configuration of a road-vehicle communication system forroad-vehicle communication.

4.1 Configuration of Road-Vehicle Communication System

FIG. 21 is a diagram illustrating the overall configuration of aroad-vehicle communication system. A configuration for road-vehiclecommunication is illustrated where the vehicle 10 (vehicle A) detects ananomaly on the onboard network of the own vehicle, an anomaly detectionnotification indicating information relating to that anomaly detectionis transmitted, and a roadside device 70 receives. The configuration ofthe vehicle A is the same as in any of the above-described first throughthird embodiments, so description will be omitted. The road-vehiclecommunication system according to the present embodiment differs fromthe inter-vehicle communication system illustrated in the firstembodiment with regard to the point that the object receiving theinter-vehicle communication message 300 transmitted from the vehicle Ais the roadside device 70 installed at the road instead of a movingvehicle.

The roadside device 70 is configured including a position informationacquisition unit 790, a road-vehicle communication messagetransmission/reception unit 740, a road-vehicle communication messageauthentication unit 730, a level interpreting unit 720, a vehicularsafety state instruction unit 750, and an external server communicationunit 770.

The level interpreting unit 720 has the same functions as the levelinterpreting unit 220 of the vehicle 20 (vehicle B) illustrated in anyof the first through third embodiments. Note however, that the levelinterpreting unit 720 notifies the vehicular safety state instructionunit 750 of instructions (execution instructions of anomaly handlingprocessing) to transmission other vehicles to a safe state correspondingto the security level indicated by level information included in theinter-vehicle communication message received from the vehicle A, basedon predetermined handling information (safety state list). Anomalyhandling processing in the present embodiment is control effected by thevehicular safety state instruction unit 750 to transition vehiclestraveling nearby the roadside device 70 to a safe state. The anomalyhandling processing includes anomaly handling processing for control tostop vehicles traveling nearby the roadside device 70 from running,anomaly handling processing for control to cause vehicles to proceedslowly, anomaly handling processing for control to cause vehicles totravel with a predetermined distance between itself and a vehicle ahead,anomaly handling processing for control to notify the drivers of thevehicles, and so forth.

The road-vehicle communication message authentication unit 730 stores asecret key and public key certificate necessary for signature generationand signature verification, and performs signature generation orsignature verification regarding road-vehicle communication messages.When transmitting (transferring) a road-vehicle communication message,the road-vehicle communication message authentication unit 730 forms theroad-vehicle communication message including position information of theroadside device 70 acquired from the position information acquisitionunit 790 and so forth, in information acquired from the levelinterpreting unit 720, and generates a signature using the secret key ofthe roadside device 70 and includes this in the road-vehiclecommunication message. The position information acquisition unit 790 mayrecord position information indicating the position where the roadsidedevice 70 has been installed, and notify this position information tothe road-vehicle communication message authentication unit 730. Theroad-vehicle communication message authentication unit 730 also performssignature verification regarding inter-vehicle communication messagesreceived from vehicles, and notifies the level interpreting unit 720 oflevel information included in the inter-vehicle communication messages.

The vehicular safety state instruction unit 750 executes anomalyhandling processing, and through the road-vehicle communication messagetransmission/reception unit 740 transmits road-vehicle communicationmessages that give vehicles present nearby the roadside device 70instructions to transition to a safe state. The format of theroad-vehicle communication message at this time is the same as with theinter-vehicle communication message described in the first embodimentthrough the third embodiment. Note that the roadside device 70 may havean electronic message sign, and the vehicular safety state instructionunit 750 may display instruction information and so forth on theelectronic message sign to guide the vehicles nearby to a safe state.

The external server communication unit 770 transmits an inter-vehiclecommunication message received from the vehicle A to an external server(omitted from illustration). The external server stores inter-vehiclecommunication messages received from the roadside device 70, and analyzethe data to decide contents of instruction, and instruct the roadsidedevice 70 to transition vehicles to a safe state. The roadside device 70that has received instructions from the external server may useroad-vehicle communication to instruct vehicles situated nearby theroadside device 70 to transition to a safe state.

4.2 Advantages of Fourth Embodiment

By using the road-vehicle communication system illustrated in the fourthembodiment with the inter-vehicle communication system according to anyone of the first through third embodiments, instructions can be notifiedto transition vehicles nearby the roadside device to a sate state byroad-vehicle communication or the like, thereby enabling a safer trafficsystem to be realized.

Fifth Embodiment

The following is a partial modification of the inter-vehiclecommunication system illustrated in the second embodiment. In theanomaly handling method used by the inter-vehicle communication systemaccording to a fifth embodiment, the contents of the predeterminedcondition (transfer condition) used at the time of determining whetheror not to transfer an anomaly detection notification (inter-vehiclecommunication message) differ from those illustrated in the secondembodiment. The transfer condition in the present embodiment is that thenumber of times of transfer having been performed up to receiving ananomaly detection notification from a vehicle (device in the vehicle)that has detected an unauthorized frame and transmitted the anomalydetection notification is smaller than a predetermined number of times.Message count information is included in the inter-vehicle communicationmessage serving as the anomaly detection notification, and the vehicle(device in the vehicle) that has received the anomaly detectionnotification performs determination regarding whether or not thetransfer condition has been satisfied, based on the count informationincluded in the received anomaly detection notification. In a case wheredetermination is made that the transfer condition is satisfied at thevehicle receiving the anomaly detection notification, transmission(transfer) of the received anomaly detection notification is thenperformed upon having updated the count information included in theanomaly detection notification.

Points that are the same as in the above-described first embodiment orsecond embodiment will be omitted regarding the inter-vehiclecommunication system according to the fifth embodiment, and points ofdifference will be described here.

5.1 Transmission of Inter-Vehicle Communication Message

FIG. 22 is a diagram illustrating an example of multiple vehiclesconsecutively notifying inter-vehicle communication messages as anomalydetection notifications to vehicles following behind. A vehicle whichhas received an inter-vehicle communication message as an anomalydetection notification transfers the anomaly detection notification in acase where the transfer condition is satisfied. The transfer conditionin the example in FIG. 22 is that the number of times that the anomalydetection notification has been transferred until reception thereof fromthe unauthorized vehicle is smaller than a predetermined number of times(twice here).

In this example, an anomaly is detected at the vehicle 10 (vehicle A),and an inter-vehicle communication message 390 a is transmitted as ananomaly detection notification from vehicle A to other vehicles. Theinter-vehicle communication message 390 a includes count informationindicating zero times as the number of times as transfer, and includescondition information indicating that the transfer condition is lessthan two times. The vehicle 20 (vehicle B) following behind the vehicleA receives the inter-vehicle communication message 390 a from thevehicle A, and since the count (zero times) that the count informationindicates satisfies less than two times which is the transfer condition,transfers an inter-vehicle communication message 390 b includinginformation relating to the anomaly detection, to transfer informationrelating to the anomaly detection included in the inter-vehiclecommunication message 390 a to other vehicles. The vehicle B includescount information indicating one time as the transfer count in theinter-vehicle communication message 390 b. The vehicle 30 (vehicle C)following behind the vehicle B receives the inter-vehicle communicationmessage 390 b from the vehicle B, and since the count (one time) thatthe count information indicates satisfies less than two times which isthe transfer condition, transfers an inter-vehicle communication message390 c including information relating to the anomaly detection, totransfer information relating to the anomaly detection included in theinter-vehicle communication message 390 b to other vehicles. The vehicleC includes count information indicating two times as the transfer countin the inter-vehicle communication message 390 c. The vehicle 40(vehicle D) following behind the vehicle C receives the inter-vehiclecommunication message 390 c from the vehicle C. The count (two times)that the count information of the received inter-vehicle communicationmessage 390 c indicates does not satisfy less than two times which isthe transfer condition at the vehicle D, so transfer is not performed.

5.2 Inter-Vehicle Communication Message Format

FIG. 23 is a diagram illustrating an example of the configuration of theinter-vehicle communication message according to the present embodiment.The inter-vehicle communication message 390 a according to the presentembodiment (as well as the inter-vehicle communication messages 390 band 390 c) has a configuration where a count information 391 for storingthe transfer count, and a condition information 392 indicating transferconditions, have been added to the configuration of the inter-vehiclecommunication message 300 illustrated in the first embodiment (see FIG.8). Accordingly, the range over which retransmission (transfer) will beperformed can be restricted.

The transfer condition indicated by the condition information 392 isthat the number of times that the anomaly detection notification hasbeen transferred until reception thereof from the vehicle (device of thevehicle) that has detected the unauthorized frame and transmitted theanomaly detection notification, is smaller than a predetermined numberof times. The condition information 392 indicates less than two times,as a specific example.

The count information 391 indicates the transfer count. This isincremented by 1 when transferred at a vehicle that transfers theinter-vehicle communication message.

5.3 Advantages of Fifth Embodiment

According to the anomaly handling method used by the inter-vehiclecommunication system of the fifth embodiment, multiple vehiclesfollowing being the vehicle where the anomaly has been detected cantransition to a safe state, in the same way as the anomaly handlingmethod illustrated in the second embodiment. Accordingly, a largeaccident where three or more vehicles are involved can be prevented.Also, vehicles far away enough from the vehicle where the anomaly hasbeen detected to where a predetermined number of transfer times of theanomaly detection notification is necessary are not controlled totransition to a safe state, so traffic congestion and the like can beprevented.

Other Embodiments

The first through fifth embodiments have thus been described above asexamples of the art relating to the present disclosure. However, the artrelating to the present disclosure is not restricted to this, and alsois applicable to embodiments where modifications, substitutions,additions, omissions, and so forth have been performed as appropriate.For example, the following modifications are also included in anembodiment of the present disclosure.

(1) Although an example of inter-vehicle communication has beenillustrated in the above embodiments where an inter-vehiclecommunication message is transmitted from a vehicle ahead to a vehiclebehind as an anomaly detection notification, the transmissiondestination is not restricted to vehicles behind, and it is sufficientfor the anomaly detection notification to be transmitted to othervehicles situated nearby the own vehicle (e.g., in front of, to theside, etc.). For example, instead of using a transmission antenna havingdirectivity behind the own vehicle by the vehicle that has detected ananomaly for inter-vehicle communication, the anomaly detectionnotification may be transmitted uniformly in all directions. In thiscase, traveling vehicles that have received the inter-vehiclecommunication message as an anomaly detection notification may measurethe position and direction of travel (bearing angle of the vehicle) ofthe own vehicle, and reference the unauthorized vehicle positioninformation in the inter-vehicle communication message serving as ananomaly detection notification, and thereby execute anomaly handlingprocessing, transfer of the anomaly detection notification, and soforth, only in a case where the unauthorized vehicle is situated in thedirection of travel of the own vehicle. Also, each vehicle may bearranged so that once the own vehicle has transferred the inter-vehiclecommunication message serving as the anomaly detection notification thathas been received, and thereafter re-received the anomaly detectionnotification transferred by another vehicle based on that anomalydetection notification (i.e., anomaly detection notifications includinginformation relating to the same anomaly detection), transfer is notperformed.

(2) Although description has been made in the above embodiments thatlevel changing conditions indicating predetermined level changing rulesare included in the inter-vehicle communication message, this may bestored in a device within the vehicle (e.g., level interpreting unit orthe like) instead of being included in the inter-vehicle communicationmessage, and referenced as necessary. An arrangement may also be made inthe same way regarding condition information indicating transferconditions where this is stored in a device within the vehicle (e.g.,level interpreting unit or the like) instead of being included in theinter-vehicle communication message, and referenced as necessary.

(3) Although four stages of levels (security levels) have been describedin the above embodiments as values of level information, the number oflevel divisions may be more than or less than four.

(4) Although description has been made in the above embodiments that thelevel of the level information is set for each function type determinedby the frame ID of the unauthorized frame as illustrated in FIG. 7,different levels may be set even through the function types are thesame, or levels may be set for each frame ID, or each ECU to which theframe ID of the unauthorized frame is to be transmitted for example, inaccordance with the content or the like of the unauthorized frame. Notethat the level information 307 may be used instead of the reset levelinformation 311 illustrated in the third embodiment, or at the time oftransmitting (transferring) the anomaly detection notification(inter-vehicle communication message) received at each vehicle, thelevel information 307 included in the received anomaly detectionnotification may be changed based on level changing conditionsindicating the predetermined level changing rules (e.g., a conditionwhere the received level information 307 is decremented by 1 if 2 ormore, or the like), and a anomaly detection notification including thelevel information 307 after changing may be transmitted (transferred).

(5) Although description has been made in the above embodiments that thevehicle has installed therein an onboard network made up of a CAN busand ECUs connected thereto, the onboard network may be any communicationnetwork and is not restricted to a CAN bus, as long as a communicationnetwork that communicates between onboard devices such as ECUs or thelike in a vehicle.

(6) Predetermined conditions (transfer conditions) relating todetermination at vehicles of whether or not to transfer anomalydetection notifications have been described in the above embodiments asdistance between vehicles or transfer counts. However, transferconditions may be conditions regarding the amount of time elapsed from aclock time at which an anomaly detection has been made. For example, atransfer condition may be a condition that the elapsed time from a clocktime that clock time information included in the received anomalydetection notification is shorter than a predetermined time (certainupper limit threshold value). To this end, clock time informationindicating the clock time at which the anomaly was detected ispreferably included in the anomaly detection notification transmitted bythe vehicle that has detected the anomaly.

(7) The anomaly detection notification described in the aboveembodiments is not restricted to being transmitted as an inter-vehiclecommunication message of the format illustrated in FIG. 8 and so forth,and may be transmitted in any inter-vehicle communication format as longas contents enabling selection of anomaly handling processing to beexecuted in a vehicle receiving the anomaly detection notification(e.g., unauthorized message ID, security level, etc.) are included.

(8) The functional distribution of the components that the vehicledescribed in the embodiments has is only exemplary, and the distributionmay be changed. For example, one or multiple ECUs provided to a vehiclethat receives anomaly detection notifications in the inter-vehiclecommunication system may have a function as a receiving unit thatreceives an anomaly detection notification transmitted from a deviceinstalled in a vehicle other than the vehicle to which the own unit isinstalled when an unauthorized frame is detected on an onboard networkinstalled in the other vehicle, and a function serving as an anomalyhandling unit that selects anomaly handling processing to execute from aplurality of predetermined anomaly handling processing in accordancewith the content of the anomaly detection notification received by thereceiving unit, and executes the selected anomaly handling processing.One or multiple devices (e.g., ECUs) connected to an onboard networkprovided to a vehicle that transmits anomaly detection notifications mayhave a function as an anomaly detection unit (unauthorized framedetection unit) that detects unauthorized frames transmitted over theonboard network, and a function as a transmission unit that transmits ananomaly detection notification to a vehicle other than the vehicle inwhich the own unit is installed when an unauthorized frame is detectedby the anomaly detection unit.

(9) Although the devices (e.g., ECUs anomaly detection ECU, etc.) in theabove embodiments have been described as being devices having digitalcircuits such as a processor, memory, and so forth, analog circuits,communication circuits, and so forth, for example, the devices mayinclude other hardware components such as a hard disk, display,keyboard, mouse, and so forth. The functions thereof may be realized bydedicated hardware (digital circuits and so forth) instead of realizingthe functions by software by a control program stored in memory beingexecuted by the processor.

(10) Part or all of the components of which the devices described in theabove embodiments are configured may be configured as one system LSI(Large Scale Integration). A system LSI is a super-multifunctional LSIfabricated with multiple components integrated on a single chip, andspecifically is a computer system configured including a microprocessor,ROM, RAM, and so forth. The RAM stores the computer program. The systemLSI achieves its functions by the microprocessor operating according tothe computer program. The components of which the above-describeddevices are configured may each be independently formed as a singlechip, or part or all may be included in a single chip. While a systemLSI has been mentioned, there are different names according to thedegree of integration, such as IC, LSI, super LSI, and ultra LSI. Theway in which the integrated circuit is formed is not restricted to LSIs,and may be realized by dedicated circuits or general-purpose processors.A FPGA (Field Programmable Gate Array) capable of being programmed aftermanufacturing the LSI, or a reconfigurable processor of which theconnections and settings of circuit cells within the LSI can bereconfigured, may be used. Moreover, in the event of the advent of anintegrated circuit technology which would replace LSIs by advance ofsemiconductor technology or a separate technology derived therefrom,such a technology may be used for integration of the functional blocks,as a matter of course. Application of biotechnology is a possibility.

(11) Part or all of the components of which the above-described devicesare configured may be configured as an IC card detachably mountable toeach device, or a standalone module. The IC card or the module is acomputer system configured including a microprocessor, ROM, RAM, and soforth. The IC card or the module may include the above-describedsuper-multifunctional LSI. The IC card or the module achieves itsfunctions by the microprocessor operating according to the computerprogram. The IC card or the module preferably is tamper-resistant.

(12) The present disclosure may in one form be the anomaly handlingmethod illustrated in FIGS. 9, 11, 14, 15, 19, 20, and so forth, may bea computer program which realizes these methods by a computer, or may bedigital signals made up of the computer program. The present disclosuremay in one form be the computer program or the digital signals recordedin a computer-readable recording medium, such as for example, a flexibledisk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (aregistered trademark) Disc), semiconductor memory, or the like. Thepresent disclosure may also be the digital signals recorded in theserecording mediums. The present disclosure may in one form be anarrangement where the computer program or the digital signals aretransmitted over an electric communication line, wireless or cablecommunication line, a network of which the Internet is representative,data broadcasting, or the like. The present disclosure may in one formbe a computer system having a microprocessor and memory, where thememory stores the computer program, and the microprocessor operatesaccording to the computer program. This may also be carried out byanother independent computer system, by the program or digital signalsbeing recorded in the recording medium and being transported, or by theprogram or digital signals being transferred over the network or thelike.

(13) Forms realized by optionally combining the components and functionsexemplified in the above-described embodiments and the above-describedmodifications are also included in the scope of the present disclosure.

This present disclosure is applicable to control other vehicles in acase where the possibility that one vehicle will be unauthorizedlycontrolled is high, so as to suppress the effects thereof.

What is claimed is:
 1. An anomaly handling method used in one or aplurality of electronic control units (ECUs) installed in one vehicle,the anomaly handling method comprising: receiving an anomaly detectionnotification transmitted from a device installed in another vehicle, theanomaly detection notification being issued when an unauthorized frameis detected in an onboard network which is installed in the othervehicle, wherein the anomaly detection notification includes (i) levelinformation indicating one of a plurality of levels and (ii) a locationof the other vehicle; selecting an anomaly handling process from aplurality of predetermined anomaly handling processes in accordance withthe one of the plurality of levels indicated by the level information;executing the selected anomaly handling process; obtaining a location ofthe one vehicle; determining whether a distance between the location ofthe other vehicle and the location of the one vehicle is within apredetermined range or not; when the distance is within thepredetermined range, changing the level information by referring tolevel change condition in which a plurality of rules to change levelinformation is defined, each of the plurality of rules corresponding toeach of predetermined distance ranges between the other vehicle and theone vehicle, and transmitting changed anomaly detection information toother vehicle; and when the distance is not within the predeterminedrange, not transmitting the received anomaly detection information tothe other vehicle, wherein the plurality of rules includes (i) a firstrule indicating that a current level included in the level informationis maintained when the distance is shorter than a first predetermineddistance, (ii) a second rule indicating that the current level isdecremented by one level when the distance is longer than or equal tothe first predetermined distance and shorter than a second predetermineddistance, and (iii) a third rule indicating that the current level isdecremented by two levels when the distance is longer than or equal tothe second predetermined distance and shorter than a third predetermineddistance.
 2. The anomaly handling method according to claim 1, whereinin the selecting, (i) selecting the anomaly handling process byreferencing handling information where each of the plurality ofpredetermined anomaly handling processes is correlated with each of theplurality of levels, and (ii) selecting the anomaly handling processcorresponding to the handling information by the level indicated by thelevel information included in the anomaly detection notification.
 3. Theanomaly handling method according to claim 2, wherein each of theplurality of anomaly handling processes includes at least one of (i)control to stop traveling of the one vehicle, (ii) control to cause theone vehicle to proceed slowly, (iii) control for the one vehicle tomaintain inter-vehicle distance as to a vehicle ahead within a certainrange, and (iv) control to notify the driver of the one vehicle.
 4. Theanomaly handling method according to claim 1, further comprisingdetermining whether or not a predetermined condition is satisfied basedon contents of the anomaly detection notification, and in case that inthe determining, determining the predetermined condition is satisfied,in the transmitting, transmitting the anomaly detection notificationexternally from the one vehicle, and in case that the predeterminedcondition is not satisfied, in the transmitting, not transmitting theanomaly detection notification.
 5. The anomaly handling method accordingto claim 1, wherein the first predetermined distance is shorter than thesecond predetermined distance, and the second predetermined distance isshorter than the third predetermined distance.
 6. The anomaly handlingmethod according to claim 5, wherein the determining determines that thedistance is within the predetermined range when the distance is shorterthan the third predetermined distance.
 7. The anomaly handling methodaccording to claim 6, wherein, the plurality of levels includes a firstlevel that controls the one vehicle to be stopped, a second level thatcontrols the one vehicle to lower its speed, a third level to controlthe one vehicle to be driven with a predetermined distance to the othervehicle, and a fourth level that notifies a driver of the one vehicle.8. The anomaly handling method according to claim 5, wherein, theplurality of levels includes a first level that controls the one vehicleto be stopped, a second level that controls the one vehicle to lower itsspeed, a third level to control the one vehicle to be driven with apredetermined distance to the other vehicle, and a fourth level thatnotifies a driver of the one vehicle.
 9. The anomaly handling methodaccording to claim 1, wherein, the plurality of levels includes a firstlevel that controls the one vehicle to be stopped, a second level thatcontrols the one vehicle to lower its speed, a third level to controlthe one vehicle to be driven with a predetermined distance to the othervehicle, and a fourth level that notifies a driver of the one vehicle.10. The anomaly handling method according to claim 1, wherein, theplurality of levels includes a first level that controls the one vehicleto be stopped, a second level that controls the one vehicle to lower itsspeed, a third level to control the one vehicle to be driven with apredetermined distance to the other vehicle, and a fourth level thatnotifies a driver of the one vehicle.
 11. An anomaly handling methodthat handles unauthorized situations by performing communication amongfirst and second vehicles, the anomaly handling method comprising:transmitting from a device installed in the first vehicle an anomalydetection notification at the time of detecting an unauthorized frame inan onboard network installed in the first vehicle; receiving the anomalydetection notification by one or a plurality of electronic control unitsinstalled in the second vehicle, wherein the anomaly detectionnotification includes (i) level information indicating one of aplurality of levels and (ii) a location of the first vehicle; selectinganomaly handling process from a plurality of predetermined anomalyhandling processes in accordance with the one of the plurality of levelsindicated by the level information; executing the selected anomalyhandling process; obtaining a location of the second vehicle;determining whether a distance between the location of the first vehicleand the location of the second vehicle is within a predetermined rangeor not; when the distance is within the predetermined range, changingthe level information by referring to level change condition in which aplurality of rules to change level information is defined, each of theplurality of rules corresponding to each of predetermined distanceranges between the first vehicle and the second vehicle, andtransmitting changed anomaly detection information to first vehicle; andwhen the distance is not within the predetermined range, nottransmitting the received anomaly detection information to the firstvehicle, wherein the plurality of rules includes (i) a first ruleindicating that a current level included in the level information ismaintained when the distance is shorter than a first predetermineddistance, (ii) a second rule indicating that the current level isdecremented by one level when the distance is longer than or equal tothe first predetermined distance and shorter than a second predetermineddistance, and (iii) a third rule indicating that the current level isdecremented by two levels when the distance is longer than or equal tothe second predetermined distance and shorter than a third predetermineddistance.
 12. The anomaly handling method according to claim 11,wherein, when the unauthorized frame is detected, the device installedin the first vehicle performs the transmission including the anomalydetection notification indicating one level selected based on, of theplurality of levels predetermined by dividing frame IDs, the frame ID ofthe unauthorized frame, and wherein the one or plurality of electroniccontrol units installed in the second vehicle perform the selection ofanomaly handling process in accordance with the level indicated by thelevel information included in the anomaly detection notification.
 13. Anelectronic control unit in one vehicle, the electronic control unitcomprising: a processor; and a memory having a program stored therein,the program causing the processor to execute operations includingreceiving an anomaly detection notification transmitted from a deviceinstalled in another vehicle, the anomaly detection notification beingissued when an unauthorized frame is detected in an onboard networkwhich is installed in the other vehicle, wherein the anomaly detectionnotification includes (i) level information indicating one of aplurality of levels and (ii) a location of the other vehicle; selectingan anomaly handling process from a plurality of predetermined anomalyhandling processes in accordance with the one of the plurality of levelsindicated by the level information; executing the selected anomalyhandling process; obtaining a location of the one vehicle; determiningwhether a distance between the location of the other vehicle and thelocation of the one vehicle is within a predetermined range or not; whenthe distance is within the predetermined range, changing the levelinformation by referring to level change condition in which a pluralityof rules to change level information is defined, each of the pluralityof rules corresponding to each of predetermined distance ranges betweenthe other vehicle and the one vehicle, and transmitting changed anomalydetection information to other vehicle; and when the distance is notwithin the predetermined range, not transmitting the received anomalydetection information to the other vehicle, wherein the plurality ofrules includes (i) a first rule indicating that a current level includedin the level information is maintained when the distance is shorter thana first predetermined distance, (ii) a second rule indicating that thecurrent level is decremented by one level when the distance is longerthan or equal to the first predetermined distance and shorter than asecond predetermined distance, and (iii) a third rule indicating thatthe current level is decremented by two levels when the distance islonger than or equal to the second predetermined distance and shorterthan a third predetermined distance.